Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

User-interactive auth on delete device #1168

Merged
merged 2 commits into from
Oct 13, 2016
Merged

User-interactive auth on delete device #1168

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fbd3866
User-interactive auth on delete device
richvdh Oct 11, 2016
9009143
Handle delete device requests with no body
richvdh Oct 12, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions synapse/rest/client/v2_alpha/devices.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@

from twisted.internet import defer

from synapse.api import constants
from synapse.http import servlet
from ._base import client_v2_patterns

Expand Down Expand Up @@ -58,6 +59,7 @@ def __init__(self, hs):
self.hs = hs
self.auth = hs.get_auth()
self.device_handler = hs.get_device_handler()
self.auth_handler = hs.get_auth_handler()

@defer.inlineCallbacks
def on_GET(self, request, device_id):
Expand All @@ -70,11 +72,15 @@ def on_GET(self, request, device_id):

@defer.inlineCallbacks
def on_DELETE(self, request, device_id):
# XXX: it's not completely obvious we want to expose this endpoint.
# It allows the client to delete access tokens, which feels like a
# thing which merits extra auth. But if we want to do the interactive-
# auth dance, we should really make it possible to delete more than one
# device at a time.
body = servlet.parse_json_object_from_request(request)

authed, result, params, _ = yield self.auth_handler.check_auth([
[constants.LoginType.PASSWORD],
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, this is probably fine for now, but isn't going to work with servers that only allow e.g. LDAP auth.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or worse, only CAS auth :/

], body, self.hs.get_ip_from_request(request))

if not authed:
defer.returnValue((401, result))

requester = yield self.auth.get_user_by_req(request)
yield self.device_handler.delete_device(
requester.user.to_string(),
Expand Down